Incident Response (DFIR)

An incident is the moment when improvisation costs the most. Under pressure, two natural reflexes do the most damage: reinstalling the server quickly (and wiping the evidence) or cutting everything off the network before understanding what happened (and losing the live state the investigation depends on). Incident response is the discipline that replaces panic with procedure: stop the bleeding, find out exactly how and since when, remove the attacker completely and return to normal — preserving everything needed to explain later what happened.

How we work

We follow the recognised incident response lifecycle (NIST SP 800-61 and SANS PICERL):

• Preparation — the step that determines how well everything else goes
• Detection and analysis — memory and disk images in order of volatility (what disappears at shutdown first), timeline reconstruction, log and telemetry analysis, with behaviour mapping to MITRE ATT&CK
• Containment — we stop the bleeding: network isolation, credential resets, command-and-control blocking, compromised account disabling — short-term and long-term
• Eradication — we remove malware, backdoors and persistence mechanisms, not just the visible symptom
• Recovery — validated restoration from clean backups, staged reconnection, heightened monitoring to confirm the threat is gone
• Post-incident — root cause (how initial access was achieved, what enabled lateral movement), lessons learned and updated playbook

We maintain defensible evidence: write-blocked acquisition, integrity hashes, documented chain of custody — so it holds up in front of a regulator or in court.

What you get

• Incident report: executive summary, technical narrative, attack timeline
• Root cause analysis and MITRE ATT&CK mapping
• Indicators and detection rules (YARA / Sigma) for future monitoring
• Chain of custody documentation and hardening recommendations

Retainer

You can have a retainer agreement: guaranteed response times, a team that already knows your environment and scope and rates agreed in advance — no contracting delays in the middle of a crisis, when every hour counts. Unused hours go towards proactive work (tabletop exercises, playbooks, readiness assessments), so the retainer delivers value even in a quiet year.